Why 'They Were My Customer' Isn't Consent

Many service businesses assume that because a customer's phone number sits in their CRM or point-of-sale system, they have permission to reach out. That assumption can be expensive. Under the TCPA, the law draws a sharp line between two consent standards: prior express consent for purely transactional messages and prior express written consent for anything promotional. The difference determines whether a campaign is compliant or a liability.

Transactional messages — appointment reminders, service confirmations, billing notices — require only prior express consent, which can be verbal or written, provided the number was shared in direct connection with that purpose. But the moment a message includes a discount, an upsell, or a "we miss you" offer, it crosses into marketing territory. That reclassification triggers the higher written-consent bar: a signed, documented agreement that clearly identifies the seller, discloses autodialed or prerecorded messages, states consent is not a condition of purchase, and captures the specific phone number. Pre-checked boxes do not count; the consumer must take an affirmative action.

The stakes are real. TCPA statutory damages run $500 per message for standard violations and up to $1,500 per message for willful ones, with no cap on aggregate exposure in a class action. TCPA litigation has surged nearly 95% year-over-year through mid-2025, and DNC Registry violations can reach $43,792 per call or text. A reactivation campaign that blurs the line between "checking in" and "here's 10% off" can turn a well-intentioned outreach into a six- or seven-figure risk.

• Prior express written consent must be obtained before the first marketing message — not during or after.
• Consent is seller-specific; a customer's relationship with your business does not extend to affiliates or third parties.
• Opt-out requests must be honored within 10 business days through any reasonable method, not just keyword replies.
• Revocation applies across all channels — a verbal opt-out on a call stops texts too.

CallMyCustomers structures every reactivation campaign around this distinction. The owner approves every script and offer before outreach begins, so promotional content is never slipped into an informational message by accident. Consent is confirmed on each contact, opt-outs are processed immediately, and the audit trail is preserved — because the cost of assuming consent is far higher than the effort of verifying it.

What Valid Consent Actually Looks Like

Valid consent isn't a checkbox exercise — it's a documented agreement that meets four non-negotiable standards. The FCC defines prior express written consent as a signed, written authorization that clearly identifies the seller, discloses the use of autodialed or prerecorded messages, and states that consent is not a condition of purchase according to compliance guidance. Pre-checked boxes don't count; the consumer must take an affirmative opt-in action as regulatory resources confirm. Vague language like "may be contacted" fails because it doesn't specify the sender, the message type, or the technology used.

• Prior — consent must exist before the first marketing message goes out; you can't text to ask for permission to text
• Express — intentionally given, never implied or bundled across brands
• Written — documented and accessible, including electronic signatures compliant with the E-SIGN Act

Voice recordings alone generally fall short unless they meet E-SIGN Act standards for electronic records and signatures as legal compliance resources note. The stakes are real: TCPA statutory damages run $500 per message and can triple to $1,500 for willful violations per industry analysis, with no cap on aggregate exposure in class actions. CallMyCustomers builds consent verification into every campaign — owners approve each script and message before outreach begins, and the booking flow captures explicit permission at the point of re-engagement. Opt-outs are honored immediately across all channels, consistent with the FCC's 10-business-day processing requirement effective April 2025 per carrier compliance updates.

Consent Isn't One-and-Done: Opt-Outs and Revocation

Consent isn't a one-time checkbox; it's an ongoing conversation. With the TCPA Revocation Rule taking effect April 11, 2025, businesses must now honor opt-out requests within 10 business days, regardless of how the consumer communicates their wish to stop receiving messages. This means a simple "please don't text me anymore" sent via email or left as a voicemail carries the same weight as replying STOP to a text—and revocation applies across all channels, silencing both calls and texts alike.

Under this updated rule, the burden of proof has shifted: if a consumer revokes consent in any reasonable manner, it's presumed valid unless the business can demonstrate why the method wasn't reasonable. As noted by legal experts, this eliminates the ability to mandate exclusive opt-out methods like keyword replies, requiring businesses to accept revocation through email, verbal requests, or other informal channels. Virginia adds another layer, mandating that opt-out records be retained for 10 years starting January 2026, while Florida provides a 15-day safe harbor after an opt-out request, limiting transactional messages to three per 24 hours per recipient.

At CallMyCustomers, we build this flexibility into every campaign by confirming consent on each contact and routing all replies—including opt-outs—directly back to the client for immediate action. Our process ensures that when a customer says no in any form, that preference is honored swiftly and comprehensively, protecting both the relationship and compliance standing. This approach transforms opt-out management from a legal checkbox into a trust-building opportunity, showing customers their preferences are not just heard, but respected across every touchpoint.

How CallMyCustomers Confirms Consent on Every Contact

Consent isn't a checkbox you tick once — it's a living record that must survive regulatory scrutiny at every touchpoint. The FCC's Revocation Rule, effective April 11, 2025, now requires businesses to honor opt-out requests within 10 business days through any reasonable method, not just keyword replies like STOP, with revocation extending across all communication channels per updated TCPA guidance. A single campaign of 100,000 messages without proper consent could exceed $150 million in class-action exposure based on statutory damages.

CallMyCustomers builds consent verification into the operational workflow rather than treating it as a compliance afterthought. Campaigns run exclusively from lists of real customers — past clients, old quotes, inactive members — never purchased leads or third-party data. The booking flow collects explicit consent at the point of service, and a double opt-in confirmation ("reply YES") provides written confirmation before any outreach begins as recommended by compliance best practices. Every script, offer, and message receives owner sign-off before deployment, which functions as a consent-quality control: if the business owner wouldn't send it personally, it doesn't go out.

• Opt-outs are honored immediately across all channels — calls, texts, and emails
• A2P 10DLC registration is completed for every sending number before outreach begins
• BAA/HIPAA-compliant handling for dental, med spa, and clinic clients
• Owner approval on every message creates an auditable consent chain

This owner sign-off isn't just procedural — it's a structural safeguard. When the business owner reviews and approves every communication, they're verifying that the message aligns with the consent their customers actually gave. The result is outreach that feels useful rather than pushy, grounded in permission that holds up under the prior express written consent standard the TCPA demands as confirmed by recent court rulings.

Your Consent Checklist Before the Next Campaign

Before your next campaign goes out the door, run a quick consent audit — because in a dispute, the burden of proof sits entirely with your business, not the customer. With TCPA litigation up nearly 95% year-over-year through mid-2025, a few minutes of verification is the cheapest insurance you'll ever buy, according to compliance analysis from Infobip.

Start with where and how each contact's consent was captured. Valid consent must be documented with a record of when, where, and how it was obtained — including timestamps — and that consent must exist before the first call or text, as consent documentation guidance makes clear. If you can't answer "when did this person opt in, and through what form," you don't have consent — you have an assumption.

Next, confirm your disclosures actually named your business. Consent language must identify the seller specifically, and vague phrasing like "may be contacted" fails the standard, ActiveProspect notes. The same goes for pre-checked boxes: the customer must take an affirmative action for consent to count.

Your pre-flight checklist should cover:

• Verify each contact's consent source, method, and timestamp before the first message goes out.
• Confirm disclosures named your business specifically and stated consent was not a condition of purchase.
• Reject bundled consent — consent gathered for multiple brands or through third-party lead forms can't be stretched to cover you, per FCC guidance on lead-generation consent.
• Keep an auditable record you could produce in a dispute — statutory damages run $500 per message, tripling to $1,500 for willful violations.
• Process every opt-out across all channels within 10 business days, since the FCC's April 2025 Revocation Rule accepts revocation in any reasonable manner, as BCLP Law explains.

That last point deserves emphasis: revocation now extends across every channel, regardless of how the opt-out arrives — an email, a voicemail, even informal language counts, and the rebuttable presumption favors the consumer.

This is exactly why CallMyCustomers starts every engagement with a free list review. Before a client spends a dollar, the team examines what the list can legitimately support — which contacts carry clean, documented consent and which segments need to be handled differently. It's the same discipline as the checklist above, applied before the first script is written.

Consent hygiene isn't a legal box to tick — it's the foundation that makes reactivation profitable. A list you can defend is a list you can monetize; a list you can't is a liability that grows with every message sent. Verify first, then run the campaign your customers actually gave you permission to send.